ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. (CVE-2026-109264)

CVE-2026-109264 describes a vulnerability in ImageMagick's MVG decoder present in versions prior to 6.9.13-57 and 7.x prior to 7.1.2-32. The issue is uncontrolled recursion that can exhaust the program stack. An attacker who can influence a file name processed by ImageMagick can cause a stack overflow, crashing the process and causing denial of service. The CVSS 3.1 base score is 3.7, reflecting a network attack vector with high attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability allows an attacker to cause a denial of service by crashing the ImageMagick process through stack exhaustion. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Upgrade ImageMagick to version 6.9.13-57 or later, or 7.1.2-32 or later, where this vulnerability is fixed. Patch status is not explicitly confirmed in the provided data, but the version numbers indicate fixed releases. If upgrading is not immediately possible, restrict or sanitize file names processed by ImageMagick to prevent exploitation.